build: production Windows release pipeline (PyInstaller, SBOM, CI, signing hook)

scripts/release_build.ps1

@@ -0,0 +1,108 @@
+#Requires -Version 5.1
+<#
+.SYNOPSIS
+  Production release build for Proxy God (ProxyChainManager.exe).
+
+.DESCRIPTION
+  Full pipeline:
+    1. Resolve Python 3.10+
+    2. Install pinned runtime + build deps
+    3. Run compileall + unittest (gate)
+    4. Stage SHA-verified bundled gost.exe
+    5. Generate Windows VERSIONINFO for the exe
+    6. PyInstaller one-file build (ProxyChainManager.spec)
+    7. Optional Authenticode sign (SIGN_CERT_PATH / SIGN_CERT_PASSWORD)
+    8. SHA256 sidecar + SBOM + RELEASE_MANIFEST.json
+    9. Zip release folder -> releases/ProxyGod-v{version}-windows-amd64.zip
+
+.PARAMETER Version
+  Override semver (default: git tag > git describe > __version__).
+
+.PARAMETER SkipTests
+  Skip compileall/unittest (not recommended for production).
+
+.PARAMETER SkipSign
+  Skip Authenticode even if SIGN_CERT_PATH is set.
+
+.PARAMETER NoZip
+  Skip creating the release zip archive.
+
+.EXAMPLE
+  powershell -NoProfile -ExecutionPolicy Bypass -File .\scripts\release_build.ps1
+
+.EXAMPLE
+  powershell -NoProfile -ExecutionPolicy Bypass -File .\scripts\release_build.ps1 -Version 1.2.0
+#>
+[CmdletBinding()]
+param(
+    [string]$Version = "",
+    [switch]$SkipTests,
+    [switch]$SkipSign,
+    [switch]$NoZip
+)
+
+$ErrorActionPreference = "Stop"
+. "$PSScriptRoot\_build_common.ps1"
+
+$root = Get-RepoRoot
+Set-Location $root
+
+$py = Resolve-PythonExe
+Write-Host "Using: $py"
+& $py -c "import sys; assert sys.version_info >= (3, 10); print(sys.version)"
+
+$ver = Get-ReleaseVersion -Override $Version
+$commit = Get-GitCommit
+Write-Host "Release version: $ver  (commit $commit)"
+
+Install-BuildDependencies -PythonExe $py -Root $root
+
+if (-not $SkipTests) {
+    Invoke-UnitTests -PythonExe $py -Root $root
+} else {
+    Write-Warning "Skipping test gate (-SkipTests)"
+}
+
+Invoke-StageBundledGost -Root $root
+Invoke-GenerateVersionInfo -PythonExe $py -Root $root -Version $ver -Commit $commit
+
+$exe = Invoke-PyInstallerBuild -PythonExe $py -Root $root
+
+if (-not $SkipSign) {
+    Invoke-CodeSign -ExePath $exe
+}
+
+$hashInfo = Write-ExeHashSidecar -ExePath $exe
+
+# Assemble release directory (versioned folder under releases/)
+$releaseDir = Join-Path $root "releases\v$ver"
+if (Test-Path $releaseDir) { Remove-Item -Recurse -Force $releaseDir }
+New-Item -ItemType Directory -Path $releaseDir | Out-Null
+
+Copy-Item -LiteralPath $exe -Destination (Join-Path $releaseDir "ProxyChainManager.exe") -Force
+Copy-Item -LiteralPath $hashInfo.Sidecar -Destination (Join-Path $releaseDir "ProxyChainManager.exe.sha256") -Force
+Copy-Item -LiteralPath (Join-Path $root "LICENSE") -Destination $releaseDir -ErrorAction SilentlyContinue
+Copy-Item -LiteralPath (Join-Path $root "docs\OPERATOR_RUNBOOK.md") -Destination $releaseDir -ErrorAction SilentlyContinue
+
+$sbom = Write-Sbom -PythonExe $py -OutDir $releaseDir -Version $ver
+Write-ReleaseManifest -OutDir $releaseDir -Version $ver -Commit $commit `
+    -ExePath $exe -Sha256 $hashInfo.Hash -Extra @{
+        sbom_file = (Split-Path -Leaf $sbom.Sbom)
+        requirements_frozen = (Split-Path -Leaf $sbom.Freeze)
+    }
+
+# Also refresh dist/ sidecars for developers
+Copy-Item -LiteralPath $hashInfo.Sidecar -Destination (Join-Path $root "dist\ProxyChainManager.exe.sha256") -Force
+
+if (-not $NoZip) {
+    $zip = New-ReleaseZip -ReleaseDir $releaseDir -Version $ver -Root $root
+    Write-Host "`n== Release complete =="
+    Write-Host "  Folder: $releaseDir"
+    Write-Host "  Zip:    $zip"
+} else {
+    Write-Host "`n== Release complete (no zip) =="
+    Write-Host "  Folder: $releaseDir"
+}
+
+Write-Host "`nVerify:"
+Write-Host "  Get-FileHash -Algorithm SHA256 releases\v$ver\ProxyChainManager.exe"